CDN SSL/TLS: Encryption from Edge to Origin
Two TLS Connections
With a CDN, HTTPS traffic involves two separate TLS connections: For foundational context, read CDN DDoS Protection: How CDNs Absorb Volumetric Attacks — FlyFish NWA.
- Client → CDN Edge: Uses your domain's certificate. The CDN terminates TLS at the edge.
- CDN Edge → Origin: A separate TLS connection from the CDN to your server.
These can use different certificates, protocols, and cipher suites.
Certificate Types
CDN-Managed Certificates
Most CDNs provision certificates automatically:
| Metric | Edge Processing | Origin Processing | Improvement |
|---|---|---|---|
| Latency (p50) | 8–15 ms | 120–300 ms | 15–20x faster |
| Cache Hit Ratio | 85–95% | N/A | Reduces origin load |
| TLS Handshake | 1–5 ms (nearby PoP) | 50–150 ms | 10–30x faster |
| Bandwidth Cost | $0.01–0.04/GB | $0.05–0.12/GB | 3–5x cheaper |
| Availability | 99.99% (multi-PoP) | 99.9% (single DC) | 10x fewer outages |
- Shared certificates — Your domain is a SAN on a certificate shared with other customers (free tier)
- Dedicated certificates — A certificate issued specifically for your domain (paid)
- Let's Encrypt / DigiCert — CDN automatically provisions and renews via ACME
Custom Certificates
Upload your own certificate to the CDN. Required for: EV certificates (green bar), certificates from specific CAs, wildcard certificates you already own.
Encryption Modes
| Mode | Client→Edge | Edge→Origin | Security Level |
|---|---|---|---|
| Off | HTTP | HTTP | None |
| Flexible | HTTPS | HTTP | Partial (origin unencrypted) |
| Full | HTTPS | HTTPS (any cert) | Good (origin may use self-signed) |
| Full (Strict) | HTTPS | HTTPS (valid cert) | Best (origin cert validated) |
Always use Full (Strict). Flexible mode leaves your origin traffic unencrypted — a man-in-the-middle between CDN and origin can intercept everything.
TLS Protocol Versions
Configure the minimum TLS version your CDN accepts:
- TLS 1.3 — Current standard. Faster handshake (1 RTT vs 2 for TLS 1.2). Stronger ciphers. No legacy cipher support needed.
- TLS 1.2 — Widely supported. Still secure with proper cipher configuration.
- TLS 1.0/1.1 — Deprecated. Disable unless you must support very old clients (IE 10, Android 4.x).
Recommended: minimum TLS 1.2, with TLS 1.3 preferred.
Cipher Suites
Cipher configuration balances security and compatibility:
# Strong TLS 1.3 ciphers (automatic, not configurable)
TLS_AES_256_GCM_SHA384
TLS_CHACHA20_POLY1305_SHA256
TLS_AES_128_GCM_SHA256
# Recommended TLS 1.2 ciphers
ECDHE-ECDSA-AES256-GCM-SHA384
ECDHE-RSA-AES256-GCM-SHA384
ECDHE-ECDSA-CHACHA20-POLY1305Key requirements: Forward secrecy (ECDHE), authenticated encryption (GCM or POLY1305), no CBC mode, no RC4, no 3DES.
Origin Certificates
For the CDN→origin connection, you have several options:
- CDN origin certificate — Cloudflare and others issue special certificates trusted only by their CDN. Free, 15-year validity. Combined with origin protection, this locks your origin to CDN-only access.
- Let's Encrypt — Standard certificates, auto-renewed. Works with any CDN.
- Self-signed — Works with "Full" mode but not "Full (Strict)". Not recommended.
HSTS and Security Headers
Configure the CDN to send security headers including HSTS:
Strict-Transport-Security: max-age=31536000; includeSubDomains; preloadHSTS forces browsers to use HTTPS for all future connections. The preload directive submits your domain to browser preload lists, ensuring HTTPS from the very first visit.
Certificate Monitoring
Monitor certificate expiration across both edge and origin. Certificate transparency logs track all certificates issued for your domain. Set alerts for: certificates expiring within 30 days, new unauthorized certificates issued for your domain, TLS handshake errors increasing.